A New Method to Detect Malicious DNS over HTTPS via Feature Reduction

The classification o f malicious D NS o ver HTTPS (DoH) as malicious or benign is a challenging task due to its encrypted nature and massive amount of data that needs to be analyzed. The lack of an accurate classification o f DoH violates the security requirements of DNS systems. Our aim in this paper is to detect malicious DoH by incorporating feature reduction to speed up the detection process with machine learning algorithms. We used three classification models with feature reductions. We achieved higher performance while keeping an acceptable accuracy reduction within a negligible margin. Experimental evaluations show that the proposed feature reduction provides a better performance for malicious DoH detection.